Skip to content
Muljax ID

Configuration & Secrets

The root .env file is the single source of truth for your configuration. It is used to generate terraform/terraform.tfvars, derive local development URLs, and establish instance branding.

Environment Variables (.env)

Section titled “Environment Variables (.env)”

Copy the provided template to create your local .env:

Terminal window
cp .env.example .env

Complete .env Specification

Section titled “Complete .env Specification”
Terminal window
# Cloudflare Configuration (Required for Terraform)
CLOUDFLARE_ACCOUNT_ID="your-cloudflare-account-id"
CLOUDFLARE_ZONE_ID="your-cloudflare-zone-id"


# Instance Branding
INSTANCE_NAME="muljax-id"
# Optional custom logo URL or dist asset path (defaults to /assets/logo.svg)
INSTANCE_LOGO="/assets/logo.svg"


# Domain Configuration
# (Do not include http:// or https:// protocols)
API_DOMAIN="id-api.example.com"
DASHBOARD_DOMAIN="id.example.com"


# Boolean true/false, defaults to false (enables HTTP instead of HTTPS for local development)
LOCALHOST=false


# ------------------------------------------------------------
# SECRETS


# High-entropy secret used once via /bootstrap to claim the initial superadmin role
ADMIN_BOOTSTRAP_SECRET="your-secure-bootstrap-secret"

Variable Reference

Section titled “Variable Reference”
Variable Required Default Description
CLOUDFLARE_ACCOUNT_ID Yes — Your 32-character Cloudflare Account ID found in the dashboard URL or dashboard overview.
CLOUDFLARE_ZONE_ID Yes — The Cloudflare Zone ID for the parent DNS zone hosting your domains.
API_DOMAIN Yes — Fully qualified domain name for the API Worker (e.g. id-api.example.com). Do not prefix with https://.
DASHBOARD_DOMAIN Yes — Fully qualified domain name for the React management dashboard (e.g. id.example.com).
ADMIN_BOOTSTRAP_SECRET Yes — A high-entropy secret string used during initial setup to claim the superadmin role via /bootstrap.
INSTANCE_NAME No muljax-id Brand name displayed across dashboard navigation, consent prompts, and browser titles.
INSTANCE_LOGO No /assets/logo.svg Local bundled asset path (under apps/dashboard/public/assets/) or remote image URL.
LOCALHOST No false When set to true, derives http:// URLs instead of https:// and permits localhost CORS origins.

Deriving Variables & Generating Keys (bun run vars)

Section titled “Deriving Variables & Generating Keys (bun run vars)”

Once .env is configured, run the automated variable generator:

Terminal window
bun run vars

This script executes three tasks in sequence (scripts/generate-tfvars.ts, scripts/oidc-key.ts, and scripts/ssh-ca-key.ts):

  1. Validate .env: Ensures all required variables (CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_ZONE_ID, API_DOMAIN, DASHBOARD_DOMAIN, and ADMIN_BOOTSTRAP_SECRET) are present.

  2. Generate terraform/terraform.tfvars: Creates the HCL variable definition file for Terraform deployments.

  3. Derive Development URLs: Appends derived URLs to .env:

    Terminal window
    # ------------------------------------------------------------
    # AUTOGENERATED (Derived by `bun run vars`)
    VITE_API_URL=https://id-api.example.com
    OIDC_ISSUER=https://id-api.example.com

  4. Generate OIDC ES256 Keypair: Generates an ECDSA P-256 private key formatted as a JSON Web Key (JWK) in terraform.tfvars if one does not already exist.

  5. Generate SSH CA Ed25519 Keypair: Generates an Ed25519 Certificate Authority keypair in terraform.tfvars if one does not already exist.

Key Rotation Scripts

Section titled “Key Rotation Scripts”

If you need to rotate or regenerate private keys:

Terminal window
bun scripts/oidc-key.ts --force

Regenerates the ECDSA P-256 OIDC private key and updates terraform/terraform.tfvars. Re-run terraform apply to deploy the new key.